RubyGems Unsafe Object Deserialization Vulnerability

Risk: High
Local: No
Remote: Yes

# Unsafe Object Deserialization Vulnerability in RubyGems There is a possible unsafe object desrialization vulnerability in RubyGems. It is possible for YAML deserialization of gem specifications to bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution. This vulnerability has been assigned the CVE identifier CVE-2017-0903. Versions Affected: >= 2.0.0. Not affected: < 2.0.0 Fixed Versions: 2.6.14 Impact ------ When packaging a Gem, RubyGems will store information about the gem (the "specification") inside the Gem package, and formatted as YAML. When reading Gem information, RubyGems will parse that YAML. Without safeguards, YAML can be used to instantiate objects in a target system. If an attacker knows about the target system, they can use these instantiated objects as a way to escalate to an RCE via other means like `Marshal.load`. Normally, a remote code execution flaw isn't a problem in RubyGems because RubyGems is designed to execute arbitrary code any time a Gem is installed. However, services that process Gems like can be impacted by this. In other words, when used as a client, RubyGems is not impacted. Applications that process Gems on the server are impacted. Releases -------- The FIXED releases are available at the normal locations. Workarounds ----------- For users that can't patch or upgrade, the following monkey patch will mitigate this risk: ``` module Gem class Specification WHITELISTED_CLASSES = %w( Symbol Time Date Gem::Dependency Gem::Platform Gem::Requirement Gem::Specification Gem::Version Gem::Version::Requirement ) WHITELISTED_SYMBOLS = %w( development runtime ) def self.from_yaml(input) input = normalize_yaml_input input spec = Psych.safe_load(input, WHITELISTED_CLASSES, WHITELISTED_SYMBOLS, true) fail Gem::EndOfYAMLException if spec && spec.class == FalseClass unless Gem::Specification === spec fail Gem::Exception, "YAML data doesn't evaluate to gem specification" end spec.specification_version ||= NONEXISTENT_SPECIFICATION_VERSION spec.reset_nil_attributes_to_default spec end end class Package def read_checksums gem Gem.load_yaml @checksums = 'checksums.yaml.gz' do |entry| Zlib::GzipReader.wrap entry do |gz_io| Psych.safe_load(, Gem::Specification::WHITELISTED_CLASSES, Gem::Specification::WHITELISTED_SYMBOLS, true) end end end end end Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset. * 2-6-whitelist-bypass.patch - Patch for 2.6 series Please note that only the 2.6.x series is supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases. Credits ------- Thanks to Max Justicz ( ) for reporting this! -- Aaron Patterson

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017,


Back to Top